Discovery
Pavri Discovery finds AI agents running in your infrastructure that are not yet instrumented with the Pavri SDK. These are called shadow assets.
How Discovery Works
Discovery uses connectors — lightweight workers that poll hosted AI platform APIs to inventory deployed agents.
Supported Platforms
Hosted coded-agent platforms:
| Platform | Connector | What It Finds |
|---|---|---|
| Google Vertex AI Agent Engine | vertex_ai_agent_engine | Deployed agents, tools, models |
| LangGraph Cloud | langgraph_hosted | Hosted assistants, graphs |
| Azure AI Foundry | azure_foundry | AI agents, tools |
| CrewAI AMP | crewai_amp | Deployed crews, agents, tools |
No/low-code workflow platforms:
| Platform | Connector | What It Finds |
|---|---|---|
| Microsoft Power Automate | power_automate | Flows, connectors, runs |
| Make.com | make | Scenarios, modules, executions |
| Zapier | zapier | Zaps, steps, task history |
| n8n | n8n | Workflows, nodes, executions |
| Workato | workato | Recipes, connectors, audit logs |
| Dialogflow CX | dialogflow | Agents, flows, webhooks |
| UiPath Orchestrator | uipath | Processes, jobs, audit logs |
| ServiceNow Flow Designer | servicenow | Flows, subflows, executions |
| Cognigy.AI | cognigy | Projects, flows, extensions |
| Botpress | botpress | Bots, integrations, webhooks |
| Flowise | flowise | Chatflows, assistants, tools |
| ManyChat | manychat | Bots, flows, external requests |
| Landbot | landbot | Bots, blocks, webhooks |
| AWS Honeycode | honeycode | Apps, tables, automations |
| LangSmith Studio | langsmith_studio | Local/hosted graphs, traces |
| Replit | replit | Projects, AI integrations |
| OpenAI Agent Builder | openai_agent_builder | Exported agent workflows |
| Generic HTTP platform | generic_http | Any platform with HTTP APIs |
No-code workflows are registered as first-class agents and appear in the same inventory, sessions, policies, and alerts surfaces as coded agents. See No/Low-Code Security Plane for the full model.
Discovery Flow
- Poll — Connectors query platform APIs on a configurable interval
- Normalize — Raw API responses are transformed into standardized discovery evidence records
- Correlate — Discovered assets are compared against SDK-registered agents to find matches
- Triage — Operators review discovered assets and decide: approve, reject, or defer
Asset Lifecycle
Every discovered asset follows this lifecycle:
unknown → discovered → correlated → reviewed → approved
↘ rejected
approved → drifted → reviewed → approved
- Unknown — Asset not yet seen by any source
- Discovered — Found by a connector, awaiting correlation
- Correlated — Matched to an SDK-registered agent (exact or fuzzy)
- Reviewed — Operator has examined the asset
- Approved — Confirmed as a known, governed agent
- Rejected — Marked as not relevant or out of scope
- Drifted — Previously approved asset has changed (tools, model, config)
Evidence and Confidence
Every discovery record is an immutable evidence entry with:
- Source — which connector produced it
- Three timestamps —
observed_at(platform time),collected_at(Pavri ingestion),processed_at(evaluation) - Confidence score — based on the source type:
| Source | Confidence | Rationale |
|---|---|---|
| SDK telemetry | 0.95 | Direct observation from instrumented agent |
| Replay evidence | 0.90 | Deterministic re-execution |
| Hosted discovery | 0.75 | API-observed, may be stale |
| MCP scan | 0.60 | Static analysis, point-in-time |
Correlation
When a discovered asset matches an SDK-registered agent, Pavri creates a correlation candidate:
- Exact match — Same agent name → confidence 0.95
- Fuzzy match — Tool overlap > 80% → confidence proportional to overlap
- Ambiguous — Multiple possible matches → queued for operator review
Ambiguous matches are never auto-merged. An operator must review and decide.
Posture History
Every change to a discovered asset is recorded in the posture history timeline:
- New capabilities added or removed
- Model changes
- Configuration drift
- Rediscovery after absence
This provides an audit trail for security reviews and compliance.
Failure Behavior
Discovery is an observability-path system. It fails open:
- If a connector cannot reach its platform, it logs a warning and continues
- Stale discovery data is acceptable
- Discovery never blocks agent operations